Director Information Security

Navacord Inc.; Toronto; On-site; CAD 140,000 - 190,000; Full time

Benefits offered by this job

Health benefits

Dental benefits

Job summary

Navacord Inc. seeks an experienced information security professional to lead governance, risk management, and advisory efforts across the organization.

You will develop and maintain policies, assess controls for new projects, and manage vendor risk programs while communicating risks to executives. The role requires extensive experience with security frameworks and audits, plus the ability to translate complex risk into actionable business decisions.

Qualifications

• 8+ years in information security with governance, risk or advisory leadership.
• Strong knowledge of security frameworks (NIST CSF, ISO 27001, SOC 2, CIS Controls).
• Experience running risk registers, exception processes and vendor risk programs.
• Experience with audits and customer security due diligence.
• Strong communication skills; able to translate technical risk for executives.

Responsibilities

• Develop, review, and maintain security policies, standards, and procedures aligned with industry frameworks.
• Assess security controls, gaps, and risk for new technologies and initiatives.
• Evaluate third-party/vendor security controls and manage vendor risk assessments.
• Conduct enterprise and project-level risk assessments; own risk reporting to leadership and boards.

Skills

Governance & risk leadership

Risk management

Security frameworks

Vendor risk management

Audits & due diligence

Executive communication

Certifications (CISSP/CISM/CRISC)

Job description

WHAT YOU’LL BE RESPONSIBLE FOR:

Policy & Standards

• Develop, review, and maintain security policies, standards, and procedures aligned with industry frameworks (NIST, ISO 27001, CIS, SOC 2, etc.)
• Ensure policies stay current with regulatory, contractual, and business requirements
• Assess security controls, gaps, and risk for new technologies, projects, and initiatives
• Evaluate third-party/vendor security controls and manage vendor risk assessments
• Conduct enterprise and project-level risk assessments
• Serve as a security advisor to business and engineering teams on control design and risk trade-offs
• Create and manage exception registry
• Establish and maintain a risk register; track identified risks through remediation or acceptance
• Manage the security exception process, including intake, review, approval, and tracking
• Own risk reporting to leadership, risk committees, and the board as needed

Audit & Compliance

• Serve as primary point of contact for internal and external security audits
• Respond to customer security questionnaires and due diligence requests
• Support certification and compliance efforts (SOC 2, ISO 27001, etc.)
• Contribute to and help build the organization's security strategy and roadmap
• Identify emerging risks and recommend program improvements

Cyber Program Delivery Overview

Contributing, tracking and monitoring delivery of key cyber programs aligned to Cyber strategy and roadmap.

Ensure costs are captured and reported on a timely basis

Assist on all cyber events as it pertains to investigation, coordinating, and reporting

WHAT YOU BRING TO THE ROLE:

• 8+ years in information security, with 3+ years in a governance, risk, or advisory leadership role
• Strong knowledge of security frameworks (NIST CSF, ISO 27001, SOC 2, CIS Controls)
• Experience running risk registers, exception processes, and vendor risk programs
• Experience with audits and customer security due diligence
• Strong communication skills; able to translate technical risk for executive audiences
• Relevant certifications preferred (CISSP, CISM, CRISC)

WHAT WE OFFER:

• Health and Dental Benefits

This is for a new role.

Navacord DOES NOT utilize artificial intelligence in the screening, assessment, or selection of applicants for this position